“Function words are very specific to the writer. Even if you are writing a thesis, you’ll probably use the same function words in chat messages.
“Even if your text is not clean, your writing style can give you away.”
The analysis techniques could also reveal botnet owners, malware tool authors and provide insight into the size and scope of underground markets, making the research appealing to law enforcement.
To achieve their results the researchers used techniques includingstylometric analysis, the authorship attribution framework Jstylo, andLatent Dirichlet allocation which can distinguish a conversation on stolen credit cards from one on exploit-writing, and similarly help identify interesting people.
The analysis was applied across millions of posts from tens of thousands of users of a series of multilingual underground websites including thebadhackerz.com, blackhatpalace.com, http://www.carders.cc, free-hack.com, hackel1te.info, hack-sector.forumh.net, rootwarez.org, L33tcrew.org and antichat.ru.